PT-2026-28204 · Unknown · Netcore Power 15Ax

Lastxuan + 1 · Publicado 2026-03-26 · Atualizado 2026-03-26 · CVE-2026-4840

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Netcore Power 15AX versions up to 3.0.0.6938

Description A security flaw exists in Netcore Power 15AX up to version 3.0.0.6938. This issue involves the setTools function within the /bin/netis.cgi file of the Diagnostic Tool Interface component. Manipulation of the IpAddr argument can lead to os command injection. Remote exploitation is possible. The exploit has been publicly released. The vendor was contacted but did not respond.

Recommendations Versions prior to 3.0.0.6938 should be updated. As a temporary workaround, restrict access to the /bin/netis.cgi file. Avoid using the IpAddr argument in the setTools function until the issue is resolved.

Exploit

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

CVE-2026-4840

Produtos afetados

Netcore Power 15Ax

Referências · 9

• 🔥 https://github.com/fakervsbln/netcore-power15ax-cve · Exploit
• https://twitter.com/TheHackerWire/status/2037036131787956486 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4840 · Nota de Segurança
• https://vuldb.com/?id.353146 · Nota
• https://twitter.com/CveFindCom/status/2037042631658623256 · Publicação no Twitter
• https://vuldb.com/?submit.776127 · Nota
• https://twitter.com/NewsNerdie/status/2037168292750630932 · Publicação no Twitter
• https://vuldb.com/?ctiid.353146 · Nota
• https://twitter.com/CVEnew/status/2037137743629680729 · Publicação no Twitter